Special ediTiON Light & Fast distros www.linuxuser.co.uk The essenTIal magazIne for ThE GNu GENEraTIoN Go light! Make lEaNEr linux perform lIGhTEr better on your faSTEr setup today DEvEloPEr GuIDE ExPErT fEaTurE Pick the The Future of perfect IDE Moore’s Law 15 editors and tools to try hEaD-To-hEaD If it’s dead, what happens next? vIrTualbox vS vMwarE worKSTaTIoN 45 DEv INTErvIEw Nate Graham on KDE: Pages of TuTorIalS “We want our software to be a lean, mean > S-TuI: visualise your stress tests > run .NET Core apps on the Pi > Essential bash > learn to productivity machine” program in Go > PyInstaller: share your projects Disc cloning tools Secure your system Kernel column Group Test Image and roll out Expert Guide What hackers look for Explained L1 terminal fault multiple machines with ease and what you need to change now + the latest kernel dev news The magazine for The GNU GeNerAtIoN Welcome Future PLC Quay House, The Ambury, Bath BA1 1UA Editorial Editor Chris Thornett [email protected] 01202 442244 Designer Paul Tysall Production Editor Ed Ricketts Editor in Chief, Tech Graham Barlow Senior Art Editor Jo Gulliver to issue 196 of Linux User & Developer Contributors Dan Aldred, Mike Bedford, Joey Bernard, Chris Binnie, Christian Cawley, Neil Bothwick, John Gowers, Toni Castillo Girona, Tam Hanna, Georgine Hodsdon, Lewis Leong, In this issue Jon Masters, Paul O’Brien, Calvin Robinson, Mayank Sharma, Shashank Sharma, Kevin Wittmer All copyrights and trademarks are recognised and respected. Linux is the registered trademark of Linus Torvalds in the U.S. » Optimise Linux, p18 and other countries. Advertising » Pick the Perfect IDE, p56 Media packs are available on request Commercial Director Clare Dove [email protected] » The Future of Moore’s Law, p64 Advertising Director Richard Hemmings %[email protected] 01225 687615 Account Director Andrew Tilbury %[email protected] Sad news, readers. After almost 19 years, this 01225 687144 Account Director Crispin Moller will be last issue of Linux User & Developer. %cris0p1i2n2.m5 [email protected] While that sinks in, the team would like to take International the opportunity to thank you all for reading and Linux User & Developer is available for licensing. Contact the International department to discuss partnership opportunities being part of our adventures in Linux and the International Licensing Director Matt Ellis [email protected] world of open source and free software. Subscriptions The magazine began in 1999 and was handed Email enquiries [email protected] UK orderline & enquiries 0344 848 2852 out to attendees of Linux Expo, and moved to the Overseas order line and enquiries +44 (0)344 848 2852 newsstand a few years later. We recently spoke Online orders & enquiries www.myfavouritemagazines.co.uk Head of subscriptions Sharon Todd to Maggie Meer, the original publisher of LU&D, Circulation and she recalled how passionate people were Head of Newstrade Tim Mathers and how producing the title felt like being part of a vast community. Production Head of Production US & UK Mark Constance That sense of community is something we take for granted now, so Production Project Manager Clare Scott Advertising Production Manager Joanne Crosby as LU&D’s little part in Linux history ends, we want to encourage Digital Editions Controller Jason Hudson Production Manager Nola Cokely you to get involved in helping the open source software you care Management about. If you’re a fan of a distro or app, consider bug testing early Managing Director Aaron Asadi Editorial Director Paul Newman releases or donating to their development; if you think something Head of Art & Design Rodney Dive Commercial Finance Director Dan Jotcham is missing from the scene – and it’s probably not a music player – Printed by then try coding it. You are what makes Linux what it is, and together Wyndeham Peterborough, Storey’s Bar Road, Peterborough, Cambridgeshire, PE1 5YS you can change the world! Happy venturing. It’s been a pleasure! Distributed by Chris Thornett, Editor Marketforce, 5 Churchill Place, Canary Wharf, London, E14 5HU www.marketforce.co.uk Tel: 0203 787 9001 Get in touch with the team: ISSN 2041-3270 We are committed to only using magazine paper which is derived from responsibly managed, certified forestry and chlorine-free manufacture. The paper in this magazine was sourced and produced from sustainable managed forests, conforming to strict [email protected] environmental and socioeconomic standards. The manufacturing paper mill holds full FSC (Forest Stewardship Council) certification and accreditation All contents © 2018 Future Publishing Limited or published under licence. All rights reserved. No part of this magazine may be used, stored, transmitted or reproduced in any way without the prior written permission of the publisher. Future Publishing Limited twitter: Facebook: Filesilo: (company number 2008885) is registered in England and Wales. Registered office: Quay House, The Ambury, Bath BA1 1UA. All information contained in this publication @linuxusermag facebook.com/ filesilohelp@ is for information only and is, as far as we are aware, correct at the time of going to press. Future cannot accept any responsibility for errors or inaccuracies in such LinuxUserUK futurenet.com information. You are advised to contact manufacturers and retailers directly with regard to the price of products/services referred to in this publication. Apps and websites mentioned in this publication are not under our control. We are not responsible for their contents or any other changes or updates to them. This magazine is fully independent and not affiliated in any way with the companies mentioned herein. If you submit material to us, you warrant that you own the material and/or have the SUbScrIptIoN oFFer necessary rights/permissions to supply the material and you automatically grant Future and its licensees a licence to publish your submission in whole or in part in any/ Subscribe and receive all issues and/or editions of publications, in any format published worldwide and on associated websites, social media channels and associated products. Any material you submit is sent at your own risk and, although every care is taken, neither Future nor its a Free Native Union employees, agents, subcontractors or licensees shall be liable for loss or damage. We assume all unsolicited material is for publication unless otherwise stated, and reserve the right to edit, amend, adapt all submissions. Free eclipse charger hub! GIFt! more DetAILS oN pAGe 30 Future plc is a public Chief executive Zillah Byng-Thorne company quoted on the Non-executive chairman Peter Allen London Stock Exchange Chief financial officer Penny Ladkin-Brand (symbol: FUTR) www.futureplc.com Tel +44 (0)1225 442 244 www.linuxuser.co.uk 3 Contents 18 32 56 Pick The PeRFecT IDE OpenSource Features Tutorials 06 News 18 Optimise Linux 36 Essential Linux: cfdisk Redis abandons open source in its Mainstream Linux distros have to Learn how to use cfdisk to partition database modules. Plus: Steam! appeal and work with a wide range disks, and how to install Linux of users and hardware, so they’re not 10 Letters always the fastest. Our guide shows 40 S-TUI: Stress-test your CPU Your final batch of beautiful words you how to streamline and optimise a U se S-TUI to monitor your CPU and run distro for your own use case a stress test from the command line 12 Interview KDE developer, Nate Graham on the 56 Pick the Perfect IDE 42 CompSec: Plug those gaps project’s bug-fixing blitz Linux provides a powerful platform for Fix the more obvious threats to your software developers and offers a wide system and that includes printers 16 Kernel Column choice of Integrated Development Jon Masters on the latest updates Environments. Discover which one 46 Python: Pyinstaller best meets your needs How to more easily share your Python SpecialReport projects using various utilities 64 The Future of Moore’s Law Is Gordon Moore’s famous dictum 50 Programming: Go 32 Coding a murderer really no longer applicable – and In part 3, we integrate an SQL How the Murder Accountability Project if so, what can we expect from the database with our video-sharing is helping to catch killers hardware of the future? server to enable keyword searching 4 issue 196 September 2018 facebook.com/LinuxUserUK 94 Free downloads Twitter: @linuxusermag We’ve uploaded a host of new free and open source software this month 86 70 42 vS 76 88 Practical Pi Reviews Back page 70 Introducing MidiIdentifier 81 Group test: Disk cloning tools 96 Goodbye, dear reader By hooking up a MIDI keyboard to a Pi, How well do Clonezilla, FOG Project, A montage of some of the many covers Andreas Scholz and karsten Schick G4L and Redo Backup & Recovery we’ve produced over the years. created a piano that attempts to guess perform when it comes to imaging and what you’re playing… rolling out multiple machines at once? 72 Build an image auto-uploader 86 Hardware SuBScRiPTion oFFeR for the Raspberry Pi Beyerdynamic’s new Amiron Wireless SuBScRiBe ToDAY Your phone can automatically upload headphones promise audio perfection pictures to the cloud, so why not the Pi over Bluetooth – but you may need a Get a free high-speed uSB Camera? Learn how to build and code second mortgage to buy them charger when you subscribe! a Dropbox-enabled solution in Python Turn to page 30 for more information 88 VMware Workstation 14.1.3 76 Run .NET Core web apps on vs VirtualBox 5.2.18 the trusty Pi One is open source, the other is FRee With Microsoft’s .NET Core now proprietary, but which one is better? GiFT! supporting ARM chips, it’s possible to run it on a reasonably recent Pi. 90 Fresh FOSS Discover how to get everything set up HSTR 1.27.0, Mattermost 5.2, Tardis for coding .NET apps 1.0.2 and Audacious 3.10 reviewed www.linuxuser.co.uk 5 06News & Opinion | 10Letters | 12Interview | 16 Kernel Column business Database maker Redis makes its module code proprietary A timely reminder that open source is not for life… Redis Labs has announced that its range of Redis Modules are no longer open source. By abandoning the AGPL licence, in favour of combining Apache v2.0 with Commons Clause, in-house modules extending the functionality of the Redis database software are now off-limits to third-party cloud service providers. Modules affected by this change include RediSearch, Redis Graph and ReJSON. Redis Labs cofounder and CTO Yiftach Shoolman justified the development in a blog post, complaining that “Cloud providers have been taking advantage of the open source community for years […]. This discourages the community from investing in developing open source code, because any potential benefit goes to cloud providers rather than the code developer.” To understand the implications of this, we spoke to Shashank Sharma (www. menschlaw.in), a trial lawyer and software licensing expert who has been writing about open source software for more than 14 years. Similarly, the Open Source Definition has He told us that while the Redis project a set of conditions defining open source remains BSD-licensed, only RedisLabs’ Redis software. By adopting the Commons Clause, Modules have been switched to the “so- Redis is eroding, or fundamentally altering, called Apache+Commons Clause license. these freedoms. “Redis call the new licence [However,] the Redis community can still for Redis Modules Apache + Commons contribute modules to the project, under Clause, which may lead to people mistakenly their own chosen licences, such as AGPL. concluding that Redis Modules are still open In fact, the lead developer in a blog post source. Any alteration of the licence terms to confirmed that his current Redis module, limit the freedoms/permissions that it allows Above Redis says it doesn’t want third-party cloud Disque, will be released under AGPL.” changes the licence from open source to providers profiting from its software The important distinction, notes Sharma, proprietary.” is that “just because the source is available Redis claims it wants to limit how cloud fees for hosting or consulting/support doesn’t make software open source or free. providers can profit from Redis deployments services related to the Software), a product There are essential freedoms (as the FSF and support services, ensuring any money or service whose value derives, entirely or calls them) which makes software Free.” made with its software isn’t by third parties. substantially, from the functionality of the But Sharma told Linux user & Developer that Software.” Just because the the adoption of the Commons Clause has Not only will this impact cloud providers, “broader implications,” referring specifically but also Linux support companies and source is available to this line of the clause: individual consultants. Sharma concludes: “‘Sell’ means practising any or all of the “The real issue for anyone using Redis is doesn’t make software rights granted to you under the Licence to how much of the reliance is on Redis Core, open source or free provide to third parties, for a fee or other and whether anyone can use Redis without consideration (including without limitation relying on Redis Modules.” 6 DistRo FeeD Top 10 (Average hits per day, 30 days to 24 August) 1. Manjaro 3691 2. Mint 2080 3. MX Linux 1884 4. elementary 1818 5. Ubuntu 1447 6. Debian 1028 7. Zorin 869 8. Fedora 718 9. openSUSe 667 gAMing 10. Solus 631 Steam Play brings more This month Windows games to Linux ■ In development (3) ■ Stable releases (7) The Arch Linux-based Modified Wine and new DirectX layer Manjaro continues to dominate the Linux promises great Linux gaming scene, but distros from the Debian family continue to dominate Just months after it seemed Valve might upstream if they’re compatible with the goals Linux overall. have given up on Linux gaming, a new beta and requirements of the larger Wine project; Highlights version of steam Play has been released, as a result, Wine users have been benefitting bringing compatibility to a big selection of from parts of this work for over a year now.” previously Windows-only games. As well Second is compatibility with Direct3D ArcoLinux as giving Linux Steam users access to a graphics, thanks to vkd3d. This Previously known as ArchMerge, larger catalogue of games, Valve hopes that implementation of Direct3D 12 uses Vulkan this distro is available in a choice developers will be able to more easily port for high-performance graphics. DXVK is also of two projects: the main desktop option projects from other platforms. included – another Vulkan implementation, and a minimal option. Whether you use the Steam client on your this time for Direct3D 11. This has involved Linux PC or you’re running Valve’s own Linux- “direct support from our open-source swagArch based SteamOS, this development means graphics group to fix Mesa driver issues This German-based distro runs that a number of top games, such as Star affecting DXVK,” and collaboration with Xfce and uses the Calamares Wars: Battlefront 2, Tekken 7, Fallout Shelter “Khronos, NVIDIA, Intel and AMD to graphical system installer. A number of and most of the Doom titles (including the coordinate Vulkan feature and driver open source apps are preinstalled. 2016 VR version) can now run on Linux. support.” Steam Play supports Windows games Meanwhile, to improve the overall gaming ArchMan/gnu Linux which don’t have a native Linux version to experience, full-screen graphics and Again using Calamares, this be installed and run within the Linux Steam multithreading have all been enhanced. Turkish Linux distro includes a client. This is made possible thanks to a two- Full-screen games will now be “seamlessly preconfigured desktop environment. The tier approach. stretched to the desired display without Octopi package manager is also included. First is the work Valve has done with interfering with the native monitor resolution Codeweavers in developing Proton, a or requiring the use of a virtual desktop.” modified version of the Wine compatibility Additionally, all Steam-supported controllers Latest distros layer. Valve’s announcement post explains should now be automatically recognised by available: that “modifications to Wine are submitted supported games. filesilo.co.uk www.linuxuser.co.uk 7 OpenSource Your Source of Linux News & Views hARDWARe Lenovo finally joins the Linux Vendor Firmware Service ThinkPad firmware updates will soon be easier to install Running a Linux-powered thinkPad, the laptop range launched by ibM and acquired by Lenovo in 2005, is a generally pleasing experience. However, without the right firmware updates, which need to be sought out, it’s unlikely to be perfect. Thanks to Lenovo joining the Linux Vendor Firmware Service, this has just become a lot easier. The LVFS enables equipment manufacturers to distribute UeFI firmware directly to users, while making the process as safe and reliable as possible, with the minimum of reboots. According to the LVFS introduction at https://fwupd.org, “The LVFS runs on a dedicated virtual private server and uses a public CDN for metadata. every month there are over 50 million files being downloaded from 10 million clients. There are Above Lenovo’s popular Linux ThinkPad line will benefit from LVFS membership currently 281 devices supported on the LVFS with 758 available firmware versions.” late. If anyone from HP is reading this, you’re reasons.” The LVFS only supports Lenovo Various manufacturers are supporting now officially late.” hardware “produced fairly recently” however; Linux in this way, but not all. Announcing Bringing Lenovo into the LVFS hasn’t just “There’s no point looking for updates on your the news in his blog, Red Hat’s Richard happened overnight. Many changes have beloved T61” is the official advice. There’s Hughes noted: “I do think Lenovo should been made to accommodate the move, such also little word on what devices from the be applauded for the work done so far due as “…changes to the low level fwupdate Chinese manufacturer will be supported in to the enormity of the task, rather than library, fwupd, and even the LVFS admin future, but it’s certainly a step in the right chastised about coming to the party a little portal itself for various vendor-defined direction for now. DistRo Chrome os 69 to include Linux support six months on from the announcement complete the set up, they’ll see a terminal regardless of hardware. Older games and of Project Crostini, Chrome os 69 is in the Chrome launcher. Developers can use those without graphics acceleration should set to introduce the ‘Linux (beta) for the terminal to install apps or packages, and run, however. Chromebooks’ feature in its 4 september the apps will be securely sandboxed inside a Software that can be expected to run release. employing virtual machines and virtual machine.” based on success under Crostini includes sandboxed containers, the feature enables Once running, Chrome OS users will be the image manipulation toolw GIMP and the installation of Linux apps, development able to install these apps from the launcher, Inkscape, as well as the Kdenlive video environments and other utilities on Google’s just like any other. While basic apps should editing suite. Meanwhile, LibreOffice should Chrome OS. work without a problem, those requiring also run, providing a strong alternative to the As the release notes for Chrome OS 69 accelerated graphics and video decoding are limits of Google’s cloud-based office suite. explain: “Linux (Beta) for Chromebooks unlikely to deliver at this stage. A list of supported devices – that is, those allows developers to use editors and HD video editing applications and that run virtual machines – can be found at command-line tools by adding support for graphics-intensive video games from Steam www.chromium.org, with Chromebooks from Linux on a Chrome device. After developers are thus unlikely to work at this stage, Acer, HP, and Lenovo among them. 8 opinion Security automata What can you do when infrastructures are too performant for humans to monitor effectively? The cloud is all the rage and it has been, in one Cloud Custodian, for example, has the ability to power form or another, for at least a decade. Vendors and down EC2 instances for patching runs, shout loudly about organisations alike continue to get caught up in what we logins by the root user, and take care of storage volumes now call cloud-native technologies and their many facets. which aren’t attached to anything useful any longer. It The CNCF (Cloud Native Computing Foundation) helps to can additionally alert and then delete gaping-wide open propagate the adoption of cloud-native tech and “open security groups (those boasting 0.0.0.0/0 IP Address source, vendor-neutral projects” in order to improve the ranges, for example) and also notify users when their accessibility of innovations in the cloud space. access keys need rotating – and deny the user access According to the CNCF, the definition of cloud-native entirely if they don’t comply within a reasonable time! Chris Binnie relates to scalable architecture which is both resilient In the same vein, the CloudBots framework from Chris’ book Linux and which offers the ability to make changes to critical, Dome9 also provides “active remediation”. In a busy Server Security: Hack live services seamlessly. As such, “containers, service working environment where new software features and Defend teaches meshes, microservices, immutable infrastructure, and keep the lights on, and therefore the bosses happy, you to make servers declarative APIs exemplify this approach.” it’s common for security and housekeeping (which invisible and mitigate However with innovation come new attack vectors, sometimes introduces other security implications) to slip attacks. See www. which need to be carefully considered by all parties devsecops.cc involved. The result is that old-school security thinking no With innovation come longer applies. The approach of “We’ll just wade through the seemingly endless code in our (micro)services and new attack vectors, which then secure and remediate any issues” simply doesn’t wash in the new cloud-native world we live in. need to be carefully Numerous security tools have sprung up from varying vendors to help deal with the new and revised attack considered by all parties surfaces which now pose a security risk to organisations. But while auditing in an automated manner to check for changes to your cloud code is a valuable exercise, there’s still a degree of operational monitoring and human down priority lists. Thankfully both tools emphasise their interaction required. ability to automate away these concerns, which means In the high-paced, dynamic world of cloud apps, just that key issues are dealt with promptly and without much auditing your security issues sadly doesn’t get anywhere fanfare in most cases. near to cutting the mustard. Thanks to the many Clearly a high degree of testing is required before events taking place during any given minute – such as actions are written into rules which affect production containers automatically spinning up as soon as another environments, but in the case of development and fails, subtle automated changes to network security staging environments, the testing is more accessible. groups and encrypted secrets being passed back and The fact that these tools also run off coded rulesets forth – to my mind we’ve already created infrastructure means of course that the GitHubs and BitBuckets of this that is too performant for humans to monitor in an world can be successfully used for revision control and effective manner. sanity testing. The solution is actually relatively straightforward; Let’s not forget, either, that misconfiguration is also rolling it out across a critical server estate is however the bane of a security professional’s life, and thus some much easier said than done. Two tools which can provide automated sweeping-up here and there is an undeniably the required functionality are Cloud Custodian (https:// welcome extra functionality. capitalone.github.io/cloud-custodian/docs) and Dome9 In short, you could say that we’re already at the point (https://dome9.com). Among their feature-sets is the where we need computers to run our other computers. ability to highlight and then automatically remediate We may be 21 years down the line from when Skynet was security and compliance issues based on a set of first meant to be activated, but let’s not forget that the predetermined rules. damned thing learns fast… www.linuxuser.co.uk 9 OpenSource Your Source of Linux News & Views Comment Your letters Questions and opinions about the mag, Linux and open source Above Linux and small board computers go together well, and tinkering with them both can open up the prospect of a career Linux 4 life top tweet not a bad tweet Dear LU&D, I was introduced to Linux many years ago for next-gen interfaces as I am, Project Soli is particularly to end on… a game project, but just did the work on a small system fascinating as it demonstrates an interaction sensor chip edward Snowden and didn’t pay much attention to it. A few years ago I using radar technology. The chip is able to pick up tiny reminds us how started doing contract work for Google ATAP (Advanced finger movements, such as simulating the turn of a dial important Linux Technology and Projects) that involved prototyping on the with a finger and thumb. is for users Pi, which started a whole new chapter in my life. seeking a secure I’ve been working with them ever since and it’s my Fred Linux operating system. favourite job, but the Linux side has taken on a life of its own. I dove in head first to learn everything I could about Dear LU&D, I don’t know if anyone has mentioned it “@Snowden If IoT devices/marketplace and Linux has been a major part already, but I would love to learn how to make my own you’re serious of it. I’ve been working my way through the popular IoT GNU/Linux distribution and maybe desktop environment about security, electronics (MCUs, SBCs, displays, sensors and motor in a future issue. Not necessarily writing one from @QubesOS is the controllers and so on) by buying the part, reading the scratch, but creating bootable media of your current best OS available datasheet, writing custom code and then publishing it on system and making it installable. today. It’s what GitHub (https://github.com/bitbank2). Frederik Scholl I use, and free. I’ve learned a ton and have come to appreciate the Nobody does VM power and simplicity of Linux. I’m able to write portable isolation better.” C code that can run on any CPU from a $7 ARM board to a $3,000 laptop. Now I’ve started to use my Linux experience and IoT knowledge to expand my client list and get new jobs in both software and hardware development. Laurence Bank Chris: Thanks, Laurence. Everyone’s journey with Linux is different and it’s exciting to think that 25 years on from the release of the Linux kernel, it’s commonplace to see people making a living from Linux in all its many, many forms. If you’ve not come across Google ATAP (https:// Above You can still use Open Build Services while it and SUSE atap.google.com), it’s worth a look. Being interested in Studio are merging, but Bodhi Builder is a good option for Ubuntu 10